Why the Enterprise Cloud Is Central to Your Security Strategy

I am fortunate enough to spend a lot of my time speaking with the technology leaders of the planet’s largest companies. Not surprisingly, given the multiple of security attacks and breaches that hit the news daily, a lot of these discussions focus on security.

I hear about the huge challenge of managing networks and datacenters that support hundreds of enterprise applications for HR, payroll, finance, legal and more from a multitude of vendors. Add to that complexity – perhaps an order of magnitude more – are the homegrown applications. The enterprise datacenter environment has an unbelievable amount of surface area that needs to be tracked and protected – APIs on the front door, customer integrations on the back door, on-ramps to import data, off-ramps to export data and so much more. There is palatable paranoia in the market today for CIOs and CISOs to not be the lead story on CNN or part of this visualization of the World’s Biggest Data Breaches.

Sometime early in the conversation, usually after some cathartic venting, I bring up a point that startles many folks: Our cloud is safer for data than your own datacenter.

We know our service. The first point I tell technology leaders is that we know our service. We wrote it from the ground up and operate only one service. We operate tens of thousands of copies of ServiceNow instances and monitor the service in intimate detail. Given that we run a single service, finding unusual signals in our monitoring that warns us about security issues is relatively straightforward. Our surface area, as I described it above, is limited to our service and that makes our cloud inherently easier to secure than a typical enterprise datacenter with a multitude of applications and services. Further, our own ServiceNow IT department is a physically diverse and separate infrastructure from our service that we offer our customers – essentially ServiceNow the company is treated exactly like our other customers.

We build homogenous environments. We are fanatics about being homogenous. Every part of our infrastructure is built with the same architecture – regardless of geography or scale. That is, the same servers, operating system, virtual machines, databases, and so forth. Homogeneity means that we can track and find issues quickly, know when we see activity that requires investigation and then deploy remediation quickly to a limited set of configurations. An enterprise datacenter is often a heterogeneous environment and finding the right activities to track is complex and difficult, if at all possible. Once an issue is found, there are often a large number of combinations of environments to deploy fixes to as well and that can slow down remediation.

We patch regularly. Many of the recent public security events occurred because a piece of infrastructure was operational and unpatched. We patch regularly and track our progress against this patching process daily. Nothing goes unpatched for security issues in our environment for any extended period of time.

Some organizations decide to move to our cloud specifically as a security strategy. After a cyber event, the CIO of Oak Ridge National Labs looked to shore up security by enhancing centralization with ServiceNow.

Take the above points and combine them with the wealth of security features that our Service Automation Platform provides to secure your data and the operational rigor we employ operating our cloud in a secure manner, and you can see why our cloud is more secure than your data center.

Stay tuned for our next posts that will continue exploring the important topic of cloud security.

Allan Leinwand

Allan Leinwand has built a reputation for managing the world’s most demanding clouds – in B2B and B2C. He is the chief technology officer at ServiceNow responsible for building and running the ServiceNow Enterprise Cloud – the second largest enterprise cloud computing environment on the planet. In this role, he is responsible for overseeing all technical aspects and guiding the long-term technology strategy for the company.
Before joining ServiceNow, Leinwand was chief technology officer – Infrastructure at Zynga, Inc. where he was focused on building one of the largest consumer cloud computing environments used in the delivery of the company’s social games to more than 80 million players daily. He got his start as a cloud pioneer at Cisco before “cloud computing” was a term and the idea of accessing applications from anywhere was still very new.
In addition to expertise in running large enterprise cloud computing environments, he also provides expertise in software engineering, quality engineering and product-market fit to companies including Spoke, Inc.; Bulletproof 360, Inc.; MapAnything, Inc.; Founders Circle Capital; and Kleiner Perkins Caufield & Byers. He is a Board member of Marin Software.
Leinwand has served as an adjunct professor at the University of California, Berkeley where he taught computer networks, network management and network design. He holds a bachelor of science degree in computer science from the University of Colorado at Boulder.